Red Hat Security Advisory

RHSA-2022:1935

php:7.4 security update

Released 2022-05-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.aarch64::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.ppc64le::php:7.4 +47

Fixes 2 records

TI-2021-04783 CVE-2021-21703 · GHSA-h8qx-36w6-3rc4

PHP-FPM memory access in root process leading to privilege escalation

LOW 37

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged u…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.01426 Published 2021-10-25 Partial fix · 7.4.25, 8.0.12 CWE-284

TI-2021-04785 CVE-2021-21705 · GHSA-rxcr-7xjm-f9c9

Incorrect URL validation in FILTER_VALIDATE_URL

LOW 28

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can b…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02091 Published 2021-10-04 Partial fix · 7.3.29, 7.4.21 +1 CWE-20